fix version 1

2026-09-22 21:15:34 +08:00
parent 9f86366638
commit d63d7e8b3a
277 changed files with 9959 additions and 1514 deletions
--- a/pkgs/all/etc/default_dev.yaml
+++ b/pkgs/all/etc/default_dev.yaml
@@ -14,12 +14,15 @@ Databases:
    - host=127.0.0.1 user=postgres password=Weidong1214 dbname=bsm_dev port=5432 sslmode=disable TimeZone=Asia/Shanghai

 Cache: redis://null:Weidong1214@127.0.0.1:6379/1
-SecretKey: CHANGE_ME
+
+# session cookie 的 HMAC 密钥，必须由部署通过环境变量提供，不得留空或使用公开占位值。
+SecretKey: ${BSM_SECRET_KEY}

 # Authorization contains the HS256 signing key and maximum token lifetime in
 # seconds. Clients send the raw JWT in the Authorization header (no Bearer).
+# 签名密钥必须由 BSM_JwtSecretKey 环境变量提供；公开样例值会被入口拒绝。
 Authorization:
-  Key: CHANGE_ME_32_BYTE_JWT_SECRET_KEY
+  Key: ${BSM_JwtSecretKey}
  Expire: 86400
  Anonymous:
    - /passport.Login/Pwd
--- a/pkgs/all/etc/default_prod.yaml
+++ b/pkgs/all/etc/default_prod.yaml
@@ -0,0 +1,150 @@
+# 生产环境配置：BSM_RuntimeMode=prod 时按 <BSM_Prefix>/etc/default_prod.yaml 读取。
+# 所有敏感值与部署相关地址一律使用环境变量占位，进程启动时由 os.ExpandEnv 展开；
+# 未提供 BSM_SECRET_KEY / BSM_JwtSecretKey 时入口会直接拒绝启动。
+Service: default
+
+Server:
+  GRPC:
+    BindIP: 0.0.0.0
+    Port: 12000
+  HTTP:
+    BindIP: 0.0.0.0
+    Port: 12001
+
+Databases:
+  Driver: postgres
+  Source:
+    - ${BSM_DB_DSN}
+
+# redis 连接串，不带库号时由 SDK 自动 HASH 选择 DB 库。
+Cache: ${BSM_REDIS_DSN}
+
+# session cookie 的 HMAC 密钥。
+SecretKey: ${BSM_SECRET_KEY}
+
+# HS256 签名密钥与 token 最长有效期（秒）；客户端把裸 JWT 放在 Authorization 头中。
+Authorization:
+  Key: ${BSM_JwtSecretKey}
+  Expire: 86400
+  Anonymous:
+    - /passport.Login/Pwd
+    - /passport.Login/Code
+    - /passport.Login/Quick
+    - /passport.Register/Pwd
+    - /passport.Register/Code
+    - /passport.Forget/Verify
+    - /passport.Forget/Reset
+    - /passport.Verify/Request
+    - /passport.Verify/JumioCallback
+    - /market.Agency/Login
+    - /mall.Staff/Login
+    - /rest/fts/ping
+    - /rest/fts/config
+    - /rest/logs/ping
+    - /rest/mgt/ping
+    - /rest/mgt/session
+    - /rest/mgt/login
+    - /rest/mgt/refresh
+    - /rest/mgt/reset
+
+# 启用的聚合服务；非空的 BSM_SERVICES 会覆盖本列表，"all" 表示全部启用。
+Services:
+  - ads
+  - cloud
+  - cms
+  - feedback
+  - fts
+  - initial
+  - logs
+  - mgt
+  - passport
+  - sender
+  - address
+  - mall
+  - market
+  - order
+  - wallet
+
+# 各模块专项配置平铺在文档根下；共享的数据库/Redis/RPC/APM/Etcd 由入口自动回填。
+Fts:
+  MinioOss:
+    Site: ${BSM_MINIO_SITE}
+    Endpoint: ${BSM_MINIO_ENDPOINT}
+    AccessKeyId: ${BSM_MINIO_ACCESS_KEY_ID}
+    AccessKeySecret: ${BSM_MINIO_ACCESS_KEY_SECRET}
+    UseSSL: true
+  Local:
+    Site: ${BSM_FTS_LOCAL_SITE}
+    UploadDir: ./uploader/
+  FtsConfig:
+    InputKey: file
+    MaxSize: 5368709120
+    Allows: [.doc, .docx, .txt, .png, .jpg, .jpeg, .gif, .pdf, .xls, .xlsx, .ppt, .pptx, .mp4, .avi, .mkv, .webp, .mov, .wmv, .mp3, .wav]
+
+Mgt:
+  # 聚合进程只执行建表迁移、不执行模块的 InitData 播种，该开关在聚合下不生效（见 AGENT.md §3.5）。
+  InitRootUser: false
+  SecretKey: ${BSM_MGT_SECRET_KEY}
+
+Passport:
+  Token:
+    Prefix: /token/
+    Expire: 86400
+  Kyc:
+    Provider: jumio
+    BaseUrl: ${BSM_JUMIO_BASE_URL}
+    ApiSecret: ${BSM_JUMIO_API_SECRET}
+    ApiToken: ${BSM_JUMIO_API_TOKEN}
+    ApiArgs: ${BSM_JUMIO_API_ARGS}
+  WeChatConf:
+    AppID: ${BSM_WECHAT_APPID}
+    AppSecret: ${BSM_WECHAT_APPSECRET}
+
+Sender:
+  SMTP:
+    default:
+      Endpoint: ${BSM_SMTP_ENDPOINT}
+      Port: 465
+      Username: ${BSM_SMTP_USERNAME}
+      Password: ${BSM_SMTP_PASSWORD}
+      FromAddress: ${BSM_SMTP_FROM_ADDRESS}
+      FromName: BSM
+  SMS:
+    default:
+      Endpoint: ${BSM_SMS_ENDPOINT}
+      AccessKeyId: ${BSM_SMS_ACCESS_KEY_ID}
+      AccessKeySecret: ${BSM_SMS_ACCESS_KEY_SECRET}
+      Region: ${BSM_SMS_REGION}
+  Code:
+    Length: 6
+    Expire: 300
+    MaxSentLimit: 5
+    CokeyKey: code
+    BlackListFilter: [127.0.0.1]
+
+Wallet:
+  QrCodeSavePath: ./qrcode/
+  WeChat:
+    AppID: ${BSM_WECHAT_APPID}
+    AppSecret: ${BSM_WECHAT_APPSECRET}
+    SerialNo: ${BSM_WECHAT_SERIALNO}
+    APIV3Key: ${BSM_WECHAT_APIV3KEY}
+    PrivateKey: ${BSM_WECHAT_PRIVATEKEY}
+    NotifyURL: ${BSM_WECHAT_NOTIFYURL}
+    Currency: CNY
+    MchID: ${BSM_WECHAT_MCHID}
+  Alipay:
+    AppID: ${BSM_ALIPAY_APPID}
+    AppSecret: ${BSM_ALIPAY_APPSECRET}
+    PrivateKey: ${BSM_ALIPAY_PRIVATEKEY}
+    IsProd: true
+    NotifyURL: ${BSM_ALIPAY_NOTIFYURL}
+    ReturnURL: ${BSM_ALIPAY_RETURNURL}
+    QuitURL: ${BSM_ALIPAY_QUITURL}
+  # 三个支付渠道开关按业务需要显式开启，默认保持关闭。
+  Wallet:
+    Name: default
+    URL: ${BSM_WALLET_URL}
+    AlipyIsOpen: false
+    WalletIsOpen: false
+    WechatpayIsOpen: false
--- a/pkgs/all/etc/default_test.yaml
+++ b/pkgs/all/etc/default_test.yaml
@@ -0,0 +1,150 @@
+# 测试环境配置：BSM_RuntimeMode=test 时按 <BSM_Prefix>/etc/default_test.yaml 读取。
+# 所有敏感值与部署相关地址一律使用环境变量占位，进程启动时由 os.ExpandEnv 展开；
+# 未提供 BSM_SECRET_KEY / BSM_JwtSecretKey 时入口会直接拒绝启动。
+Service: default
+
+Server:
+  GRPC:
+    BindIP: 0.0.0.0
+    Port: 12000
+  HTTP:
+    BindIP: 0.0.0.0
+    Port: 12001
+
+Databases:
+  Driver: postgres
+  Source:
+    - ${BSM_DB_DSN}
+
+# redis 连接串，不带库号时由 SDK 自动 HASH 选择 DB 库。
+Cache: ${BSM_REDIS_DSN}
+
+# session cookie 的 HMAC 密钥。
+SecretKey: ${BSM_SECRET_KEY}
+
+# HS256 签名密钥与 token 最长有效期（秒）；客户端把裸 JWT 放在 Authorization 头中。
+Authorization:
+  Key: ${BSM_JwtSecretKey}
+  Expire: 86400
+  Anonymous:
+    - /passport.Login/Pwd
+    - /passport.Login/Code
+    - /passport.Login/Quick
+    - /passport.Register/Pwd
+    - /passport.Register/Code
+    - /passport.Forget/Verify
+    - /passport.Forget/Reset
+    - /passport.Verify/Request
+    - /passport.Verify/JumioCallback
+    - /market.Agency/Login
+    - /mall.Staff/Login
+    - /rest/fts/ping
+    - /rest/fts/config
+    - /rest/logs/ping
+    - /rest/mgt/ping
+    - /rest/mgt/session
+    - /rest/mgt/login
+    - /rest/mgt/refresh
+    - /rest/mgt/reset
+
+# 启用的聚合服务；非空的 BSM_SERVICES 会覆盖本列表，"all" 表示全部启用。
+Services:
+  - ads
+  - cloud
+  - cms
+  - feedback
+  - fts
+  - initial
+  - logs
+  - mgt
+  - passport
+  - sender
+  - address
+  - mall
+  - market
+  - order
+  - wallet
+
+# 各模块专项配置平铺在文档根下；共享的数据库/Redis/RPC/APM/Etcd 由入口自动回填。
+Fts:
+  MinioOss:
+    Site: ${BSM_MINIO_SITE}
+    Endpoint: ${BSM_MINIO_ENDPOINT}
+    AccessKeyId: ${BSM_MINIO_ACCESS_KEY_ID}
+    AccessKeySecret: ${BSM_MINIO_ACCESS_KEY_SECRET}
+    UseSSL: true
+  Local:
+    Site: ${BSM_FTS_LOCAL_SITE}
+    UploadDir: ./uploader/
+  FtsConfig:
+    InputKey: file
+    MaxSize: 5368709120
+    Allows: [.doc, .docx, .txt, .png, .jpg, .jpeg, .gif, .pdf, .xls, .xlsx, .ppt, .pptx, .mp4, .avi, .mkv, .webp, .mov, .wmv, .mp3, .wav]
+
+Mgt:
+  # 聚合进程只执行建表迁移、不执行模块的 InitData 播种，该开关在聚合下不生效（见 AGENT.md §3.5）。
+  InitRootUser: false
+  SecretKey: ${BSM_MGT_SECRET_KEY}
+
+Passport:
+  Token:
+    Prefix: /token/
+    Expire: 86400
+  Kyc:
+    Provider: jumio
+    BaseUrl: ${BSM_JUMIO_BASE_URL}
+    ApiSecret: ${BSM_JUMIO_API_SECRET}
+    ApiToken: ${BSM_JUMIO_API_TOKEN}
+    ApiArgs: ${BSM_JUMIO_API_ARGS}
+  WeChatConf:
+    AppID: ${BSM_WECHAT_APPID}
+    AppSecret: ${BSM_WECHAT_APPSECRET}
+
+Sender:
+  SMTP:
+    default:
+      Endpoint: ${BSM_SMTP_ENDPOINT}
+      Port: 465
+      Username: ${BSM_SMTP_USERNAME}
+      Password: ${BSM_SMTP_PASSWORD}
+      FromAddress: ${BSM_SMTP_FROM_ADDRESS}
+      FromName: BSM
+  SMS:
+    default:
+      Endpoint: ${BSM_SMS_ENDPOINT}
+      AccessKeyId: ${BSM_SMS_ACCESS_KEY_ID}
+      AccessKeySecret: ${BSM_SMS_ACCESS_KEY_SECRET}
+      Region: ${BSM_SMS_REGION}
+  Code:
+    Length: 6
+    Expire: 300
+    MaxSentLimit: 5
+    CokeyKey: code
+    BlackListFilter: [127.0.0.1]
+
+Wallet:
+  QrCodeSavePath: ./qrcode/
+  WeChat:
+    AppID: ${BSM_WECHAT_APPID}
+    AppSecret: ${BSM_WECHAT_APPSECRET}
+    SerialNo: ${BSM_WECHAT_SERIALNO}
+    APIV3Key: ${BSM_WECHAT_APIV3KEY}
+    PrivateKey: ${BSM_WECHAT_PRIVATEKEY}
+    NotifyURL: ${BSM_WECHAT_NOTIFYURL}
+    Currency: CNY
+    MchID: ${BSM_WECHAT_MCHID}
+  Alipay:
+    AppID: ${BSM_ALIPAY_APPID}
+    AppSecret: ${BSM_ALIPAY_APPSECRET}
+    PrivateKey: ${BSM_ALIPAY_PRIVATEKEY}
+    IsProd: true
+    NotifyURL: ${BSM_ALIPAY_NOTIFYURL}
+    ReturnURL: ${BSM_ALIPAY_RETURNURL}
+    QuitURL: ${BSM_ALIPAY_QUITURL}
+  # 三个支付渠道开关按业务需要显式开启，默认保持关闭。
+  Wallet:
+    Name: default
+    URL: ${BSM_WALLET_URL}
+    AlipyIsOpen: false
+    WalletIsOpen: false
+    WechatpayIsOpen: false